[SSSD] How to map primaryGID? was "Re: [PATCHES][PRELIMINARY] Add support for Active Directory objectSID mappings"

Jakub Hrozek jhrozek at redhat.com
Mon Apr 23 09:08:48 UTC 2012


On Mon, Apr 23, 2012 at 09:35:44AM +0200, Sumit Bose wrote:
> On Sun, Apr 22, 2012 at 08:07:56PM -0400, Stephen Gallagher wrote:
> > On Sun, 2012-04-22 at 17:27 -0400, Simo Sorce wrote:
> > > On Sun, 2012-04-22 at 15:10 -0400, Stephen Gallagher wrote:
> > > > Ok, I just hit a snag and I'm not sure how best to proceed. All users on
> > > > a POSIX system need to have a default GID value, which in most cases is
> > > > mapped to a user-private group to help avoid accidental permission-leaks
> > > > when that user creates files.
> > > > 
> > > > However, when mapping a user from Active Directory's objectSID, we don't
> > > > have an obvious group to which we can map the primaryGID. I'm not sure
> > > > how best to proceed here.
> > > 
> > > Why can't you use the Primary-Group-ID attribute ?
> > > 
> > 
> > I was confused about that. It looked like it was a POSIX attribute that
> > I couldn't rely on. It appears I was mistaken. It's a bit annoying,
> > though. As near as I can tell, it's just the RID portion of the
> > objectSID of the group. So I should be able to just take the minimum
> > value of the domain and add this value to it to generate the mapped ID.
> 
> yes, it is the RID. Since one of the goals here is to be featear
> compatible with nss-pam-ldapd it might make sense to see how this is
> handled there. But I would expect it does just the same.
> 
> bye,
> Sumit
> 

We checked the nss-pam-ldapd code with Sumit and actually there is no
default, the behaviour must be specified in the config file.

They can check the value of the objectSid attribute for both uid and gid
if configured, which is what Simo was suggesting. And because the
Primay-Group-ID is just the RID, that can be used as well.



More information about the sssd-devel mailing list